Node.js HTTP Request Smuggling (CVE-2022-35256): Anatomy of a Parsing Flaw in llhttp

HTTP request smuggling attacks have made headlines because they can subvert application logic, poison caches, and bypass security controls, even in well-defended web architectures. In late 2022, a parsing flaw in the llhttp module of Node.js (CVE-2022-35256) brought this class of attack into the core of one of the world's most popular server-side runtimes. The effects reached enterprise, cloud, and industrial IoT deployments.

Introduction

In December 2022, security teams at Siemens and other major vendors were rushing to patch a subtle but dangerous vulnerability in the Node.js HTTP stack. Attackers were able to slip malicious HTTP requests past front-end proxies and into backend Node.js servers by exploiting a parsing inconsistency in the llhttp library. The vulnerability, tracked as CVE-2022-35256, enabled HTTP request smuggling, a technique known for bypassing authentication, poisoning caches, and compromising sensitive data. The flaw was present in Node.js versions 14.x before 14.20.1, 16.x before 16.17.1, and 18.x before 18.9.1, so it reached a large part of the modern web and industrial control systems.

About the Involved Parties:

• Node.js is the world's leading server-side JavaScript runtime, with millions of deployments running web apps, APIs, and IoT platforms. Much of modern web infrastructure is built on its ecosystem.
• llhttp is the high-performance HTTP parser used by Node.js. It was designed for speed and efficiency, and this vulnerability shows that the speed sometimes came at the cost of strict protocol compliance.
• Siemens is a global leader in industrial automation and digitalization. Some of its products, such as SINEC INS, use Node.js for network management, so a Node.js vulnerability there bears directly on critical infrastructure.

Technical Information

CVE-2022-35256 comes from how the llhttp parser in Node.js handled the end of each HTTP header line. RFC 7230 requires every header line to end with a CRLF sequence (\r\n). Until llhttp version 6.0.10, though, the parser also accepted headers ending in a lone CR (\r) or a bare LF (\n).

The deviation looks minor, but it created a dangerous ambiguity. If a front-end proxy (such as NGINX or a cloud load balancer) enforced strict CRLF termination and the Node.js backend did not, an attacker could craft a request that the proxy read as one request and the backend read as two. HTTP request smuggling rests on exactly this kind of gap, where two systems parse the same request differently and an attacker uses the difference to "smuggle" a malicious payload past security controls.

Example Exploit Scenario:

Suppose an attacker sends the following HTTP request:

GET / HTTP/1.1\r\n
Host: victim.com\r

X-Foo: bar\r

Transfer-Encoding: chunked\r\n

0\r\n\r\n

A proxy that requires strict CRLF termination treats this as a single request. The vulnerable llhttp parser in Node.js may instead read the Transfer-Encoding: chunked header as the start of a new request, which lets the attacker "smuggle" a second request into the backend. An attacker can use that to bypass authentication, poison shared caches, or steal session cookies.

The vulnerability is most dangerous where Node.js sits behind a proxy or load balancer that normalizes HTTP requests differently from the backend parser. In that setup, attackers can exploit it to:

• Bypass authentication and authorization controls
• Poison HTTP caches
• Steal or manipulate session data
• Potentially execute arbitrary code in some configurations

The flaw is tracked as CWE-444 (Inconsistent Interpretation of HTTP Requests), and it does the most damage in complex, layered web architectures.

Patch Information

To fix the request smuggling caused by incorrect parsing of header fields, the Node.js team updated the llhttp parser. The patched parser requires every HTTP header field to end with the CRLF (Carriage Return and Line Feed) sequence, so attackers can no longer exploit improperly terminated headers.

The fix moves the llhttp library to version 6.0.10, which adds stronger validation to enforce correct header termination. Node.js versions 14.20.1, 16.17.1, and 18.9.1 include the updated library. Upgrading to one of them protects an application against request smuggling attacks that rely on this parsing issue.

The official Node.js blog post has the full details of this security release: September 23rd 2022 Security Releases.

Affected Systems and Versions

CVE-2022-35256 affects these Node.js versions:

• Node.js 14.x: All versions prior to 14.20.1
• Node.js 16.x: All versions prior to 16.17.1
• Node.js 18.x: All versions prior to 18.9.1

Any deployment on these versions is vulnerable to request smuggling through improperly terminated headers. The risk is highest when Node.js runs behind a proxy or load balancer that enforces strict CRLF parsing.

Siemens SINEC INS and other products that embed vulnerable Node.js versions are also affected. Debian and other Linux distributions have issued security advisories and backports for their packaged Node.js versions.

Vendor Security History

Node.js has a mature security process, with regular audits and a public vulnerability disclosure program. Even so, the llhttp parser's preference for performance over strict protocol compliance has produced earlier parsing vulnerabilities. CVE-2022-35256 took more than a year to go from initial report to patch, which reflects how hard it is to change foundational parsing logic in a widely used runtime. Siemens responded promptly with advisories and patches for its affected products. Its case shows how much supply chain security matters in industrial environments.

References

• NVD Entry for CVE-2022-35256
• Node.js September 2022 Security Releases
• Siemens Advisory SSA-332410
• HackerOne Report 1675191
• Debian Security Advisory DSA-5326

Source: This report was created using AI

If you have suggestions for improvement or feedback, please email us at [email protected]